Gmanehttp://gmane.org/img/gmane-25t.pnghttp://gmane.org
new errata for TCP, exec, and patchhttp://permalink.gmane.org/gmane.os.openbsd.announce/238
<pre>A few patches are now available. Please consult the website for details.
OpenBSD 5.6 errata:
http://www.openbsd.org/errata56.html
027: SECURITY FIX: July 14, 2015 All architectures
A TCP socket can become confused and not properly cleanup resources.
A source code patch exists which remedies this problem.
028: RELIABILITY FIX: July 26, 2015 All architectures
A kernel memory leak could be triggered by an unprivileged user in a failure
case when using execve under systrace.
A source code patch exists which remedies this problem.
029: SECURITY FIX: July 26, 2015 All architectures
The patch utility could be made to invoke arbitrary commands via the obsolete
SCCS and RCS support when processing a crafted input file. This patch deletes
the SCCS and RCS support.
A source code patch exists which remedies this problem.
OpenBSD 5.7 errata:
http://www.openbsd.org/errata57.html
010: SECURITY FIX: July 14, 2015 All architectures
A TCP socket can become confused and not properly cleanup resource</pre>Ted Unangst2015-07-27T17:29:21Microsoft Now OpenBSD Foundation Gold Contributorhttp://permalink.gmane.org/gmane.os.openbsd.announce/237
<pre>The OpenBSD Foundation is happy to announce that Microsoft has made
a significant financial donation to the Foundation. This donation
is in recognition of the role of the Foundation in supporting the
OpenSSH project. This donation makes Microsoft the first Gold level
contributor in the OpenBSD Foundation's 2015 fundraising campaign.
Donations to the Foundation can be made on our Donations Page at
www.openbsdfoundation.org/donations.html
We can be contacted regarding corporate sponsorship at
fundraising&lt; at &gt;openbsdfoundation.org.
</pre>Kenneth R Westerback2015-07-08T14:11:12LibreSSL 2.2.1 releasedhttp://permalink.gmane.org/gmane.os.openbsd.announce/236
<pre>We have released LibreSSL 2.2.1, which will be arriving in the
LibreSSL directory of your local OpenBSD mirror soon.
This release continues from the OpenBSD 5.8 development tree, featuring
expanded OS support, code improvements, and feature removal. Also note
that SSLv3 support has not been removed yet, but it should happen soon.
Notable changes in this release are:
* Assorted build fixes for musl, HP-UX, Mingw, and Solaris.
* Initial support for Windows 2009, 2003, and XP.
* Protocol parsing conversions to BoringSSL's CRYPTO ByteString (CBS) API
* Added EC_curve_nid2nist and EC_curve_nist2nid from OpenSSL
* Removed Dynamic Engine support
* Removed MDC-2DES support
The LibreSSL project continues improvement of the codebase to reflect modern,
safe programming practices. We welcome feedback and improvements from the
broader community. Thanks to all of the contributors who helped make this
release possible.
</pre>Brent Cook2015-07-08T12:49:25LibreSSL erratahttp://permalink.gmane.org/gmane.os.openbsd.announce/235
<pre>Patches are now available to fix a few issues in LibreSSL's libcrypto.
CVE-2015-1788 - Malformed ECParameters causes infinite loop
CVE-2015-1789 - Exploitable out-of-bounds read in X509_cmp_time
CVE-2015-1792 - CMS verify infinite loop with unknown hash function
Note that CMS was already disabled in LibreSSL.
Several other issues did not apply or were already fixed and one low
severity issue is under review. For more information, see
https://www.openssl.org/news/secadv_20150611.txt
Thanks to the OpenSSL team for providing patches.
5.7 patch:
http://ftp.openbsd.org/pub/OpenBSD/patches/5.7/common/009_openssl.patch.sig
http://www.openbsd.org/errata57.html
5.6 patch:
http://ftp.openbsd.org/pub/OpenBSD/patches/5.6/common/026_openssl.patch.sig
http://www.openbsd.org/errata56.html
</pre>Doug Hogan2015-06-11T23:20:22smtpd erratahttp://permalink.gmane.org/gmane.os.openbsd.announce/234
<pre>Patches are now available for 5.6 and 5.7 which fix an smtpd errata.
5.6 errata 25 and 5.7 errata 8:
Fix multiple reliability issues in smtpd:
a local user can cause smtpd to fail by writing an invalid imsg to control socket.
a local user can prevent smtpd from serving new requests by exhausting descriptors.
Links:
http://www.openbsd.org/errata56.html
http://ftp.openbsd.org/pub/OpenBSD/patches/5.6/common/025_smtpd.patch.sig
http://www.openbsd.org/errata57.html
http://ftp.openbsd.org/pub/OpenBSD/patches/5.7/common/008_smtpd.patch.sig
</pre>Gilles Chehade2015-06-11T19:41:12LibreSSL 2.1.7 and 2.2.0 releasedhttp://permalink.gmane.org/gmane.os.openbsd.announce/233
<pre>We have released LibreSSL 2.2.0, which will be arriving in the
LibreSSL directory of your local OpenBSD mirror soon.
This release is the first from the OpenBSD 5.8 development tree and
features mainly on build system improvements and new OS support.
We have also released LibreSSL 2.1.7, which contains additional security
fixes.
* AIX Support - thanks to Michael Felt
* Cygwin Support - thanks to Corinna Vinschen
* Refactored build macros, support packaging libtls independently.
There are more pieces required to support building and using OpenSSL
with libtls, but this is an initial start at providing an
independent package for people to start hacking on.
* Removal of OPENSSL_issetugid and all library getenv calls.
Applications can and should no longer rely on environment variables
for changing library behavior. OPENSSL_CONF/SSLEAY_CONF is still
supported with the openssl(1) command.
* libtls API and documentation additions
* Various bug fixes and simplifications to l</pre>Brent Cook2015-06-11T16:35:47Verisign Announces vBSDcon 2015http://permalink.gmane.org/gmane.os.openbsd.announce/232
<pre>Following the success of the inaugural vBSDcon, Verisign has elected to host a second vBSDcon in Reston, Va at the Sheraton Reston hotel the weekend of September 11, 2015. vBSDcon is a technical conference focused on the BSD family of operating systems including, but not limited to, FreeBSD, OpenBSD, NetBSD, and others. Any user, developer, engineer, or innovator involved with any of the BSD family of operating systems will want to mark these dates. vBSDcon will feature plenary talks, Birds of a Feather discussions, lightning talks, and much more. Full details are available at http://www.vBSDcon.com/.
Additionally, While vBSDcon currently does not operate an “official” call for presentations, proposals will be accepted until June. Anyone wishing to submit a talk is invited to do so by emailing vBSDcon&lt; at &gt;verisign.com. The event agenda is expected to be finalized and published in mid-June.
We look forward to seeing you September 11, 2015!
--
Vincent (Rick) Miller
Systems Engineer
vmiller&lt; at &gt;verisign.co</pre>Miller, Vincent (Rick2015-05-04T18:30:495.7 CDs delayedhttp://permalink.gmane.org/gmane.os.openbsd.announce/231
<pre>Sorry, 5.7 CDs will be delayed because of an error at the production
plant.
We all hoped it would be resolved before release day, or at most a day
or so after. It has dragged on.
First delay in nearly 20 years. That is kind of crazy, isn't it.
Of course the online release is out like clockwork.
</pre>Theo de Raadt2015-05-01T05:05:11OpenBSD 5.7 Releasedhttp://permalink.gmane.org/gmane.os.openbsd.announce/230
<pre>May 1, 2015.
We are pleased to announce the official release of OpenBSD 5.7.
This is our 37th release on CD-ROM (and 38th via FTP/HTTP). We remain
proud of OpenBSD's record of more than ten years with only two remote
holes in the default install.
As in our previous releases, 5.7 provides significant improvements,
including new features, in nearly all areas of the system:
- Improved hardware support, including:
o New xhci(4) driver for USB 3.0 host controllers.
o New umcs(4) driver for MosChip Semiconductor 78x0 USB multiport
serial adapters.
o New skgpio(4) driver for Soekris net6501 GPIO and LEDs.
o New uslhcom(4) driver for Silicon Labs CP2110 USB HID based UART.
o New nep(4) driver for Sun Neptune 10Gb Ethernet devices.
o New iwm(4) driver for Intel 7260, 7265, and 3160 wifi cards.
o The rtsx(4) driver now supports RTS5227 and RTL8411B card readers.
o The bge(4) driver now supports jumbo frames on various additional
BCM57xx chipsets.
o The ciss(4) drive</pre>Stefan Sperling2015-04-30T22:06:14tar/pax/cpio patch availablehttp://permalink.gmane.org/gmane.os.openbsd.announce/229
<pre>Patches are now available for 5.6 and 5.7 which fix security issues
in the combined tar, pax, and cpio program's handling of malicious
archives, as well as archives with large pax extension headers.
Our thanks to Daniel Cegielka for reporting this.
Note that the patches for 5.6 and 5.7 have several differences, so be
sure to download the correct version.
Links:
http://www.openbsd.org/errata56.html
http://ftp.openbsd.org/pub/OpenBSD/patches/5.6/common/024_tar.patch.sig
and
http://www.openbsd.org/errata57.html
http://ftp.openbsd.org/pub/OpenBSD/patches/5.7/common/007_tar.patch.sig
OpenBSD 5.7 errata 7, Apr 30, 2015:
tar/pax/cpio had multiple issues:
* extracting a malicious archive could create files outside of the
current directory without using pre-existing symlinks to 'escape',
and could change the timestamps and modes on preexisting files
* tar without -P would permit extraction of paths with ".." components
* there was a buffer overflow in the handling of pax extension headers,
Apply </pre>Philip Guenther2015-04-30T20:38:31kernel patch availablehttp://permalink.gmane.org/gmane.os.openbsd.announce/228
<pre>Patches are now available for 5.6 and 5.7 which fix local security
issues in the kernel's handling of malformed ELF executables, which
could be used to panic the kernel or view some kernel memory.
Our thanks to Alejandro Hernandez for test cases and Maxime Villard
for providing the basis for one of the changes.
Links:
http://www.openbsd.org/errata56.html
http://ftp.openbsd.org/pub/OpenBSD/patches/5.6/common/023_elf.patch.sig
and
http://www.openbsd.org/errata57.html
http://ftp.openbsd.org/pub/OpenBSD/patches/5.7/common/006_elf.patch.sig
untrusted comment: signature from openbsd 5.7 base secret key
RWSvUZXnw9gUby4OBLM0n2MCFo9TM/FWZlryKfa4mLnPMEgi87dSLa8HTEXN15Z0YumeDyfsnFVHyQHjtL6106R1LxIOtJ/6pww=
OpenBSD 5.7 errata 6, Apr 30, 2015:
Missing validity checks in the kernel ELF loader meant malformed binaries
could trigger kernel panics or view kernel memory.
Apply by doing:
cd /usr/src
signify -Vep /etc/signify/openbsd-57-base.pub -x 006_elf.patch.sig -m - | \
patch -p0
Then build and </pre>Philip Guenther2015-04-30T20:38:23reminder: mailing list server downtimehttp://permalink.gmane.org/gmane.os.openbsd.announce/227
<pre>The machine room that lists.openbsd.org will be undergoing maintenance
Saturday April 18th. As a reasult, the list server will be taken
down at 5:30am MDT. The current estimate is that everything will
be back up between 3-5pm MDT.
This also affects ftp.usa.openbsd.org and anoncvs3.usa.openbsd.org
which are located in the same machine room.
</pre>Todd C. Miller2015-04-16T15:32:45mailing list server downtimehttp://permalink.gmane.org/gmane.os.openbsd.announce/226
<pre>The machine room that lists.openbsd.org will be undergoing maintenance
Saturday April 18th. As a reasult, the list server will be taken
down at 5:30am MDT and brought back up in the early afternoon.
This also affects ftp.usa.openbsd.org and anoncvs3.usa.openbsd.org
which are located in the same machine room.
- todd
</pre>Todd C. Miller2015-03-31T11:36:45OpenNTPD 5.7p4 releasedhttp://permalink.gmane.org/gmane.os.openbsd.announce/225
<pre>OpenNTPD 5.7p4 has just been released. It will be available from the mirrors
listed at http://www.openntpd.org/ shortly.
OpenNTPD is a FREE, secure, and easy to use implementation of the Network Time
Protocol. It provides the ability to sync the local clock to remote NTP servers
and can act as NTP server itself, redistributing the local clock.
Changes since OpenNTPD 5.7p3
============================
* Added support for using HTTPS time constraints to validate NTP responses.
You can find a detailed description of the feature and how it works here:
http://marc.info/?l=openbsd-tech&amp;m=142356166731390&amp;w=2
See the man page and example config file for configuration details.
The libtls library, as shipped with LibreSSL 2.1.4 or later, is
required to use the HTTPS constraint feature, though it is not
required to use OpenNTPD.
* Workaround a bug in the Solaris adjtime call that caused the olddelta to
never reach 0, leading to continual sync/unsync messages from ntpd.
* Workaround an overflow on </pre>Brent Cook2015-03-25T02:11:41LibreSSL 2.1.6 releasedhttp://permalink.gmane.org/gmane.os.openbsd.announce/224
<pre>We have released LibreSSL 2.1.6, which will be arriving in the
LibreSSL directory of your local OpenBSD mirror soon.
This release primarily addresses a number of security issues in
coordination with the OpenSSL project.
Fixes for the following issues are integrated into LibreSSL 2.1.6:
* CVE-2015-0286 - Segmentation fault in ASN1_TYPE_cmp
* CVE-2015-0287 - ASN.1 structure reuse memory corruption
* CVE-2015-0289 - PKCS7 NULL pointer dereferences
* CVE-2015-0209 - Use After Free following d2i_ECPrivatekey error
* CVE-2015-0288 - X509_to_X509_REQ NULL pointer deref
The patch for this issue is integrated in LibreSSL 2.1.6:
* CVE-2015-0207 - Segmentation fault in DTLSv1_listen
LibreSSL is not vulnerable, but the fix was safe to merge.
The following issues were addressed in earlier LibreSSL releases:
* CVE-2015-0204 - RSA silently downgrades to EXPORT_RSA
Fixed in LibreSSL 2.1.2 - reclassifed from low to high,
* CVE-2015-0292 - Fault processing Base6</pre>Brent Cook2015-03-19T15:23:50libre/openssl patches availablehttp://permalink.gmane.org/gmane.os.openbsd.announce/223
<pre>Patches are now available to fix a variety of issues in libcrypto and libssl.
For 5.6 and the forthcoming 5.7 release:
CVE-2015-0209 - Use After Free following d2i_ECPrivatekey error
CVE-2015-0286 - Segmentation fault in ASN1_TYPE_cmp
CVE-2015-0287 - ASN.1 structure reuse memory corruption
CVE-2015-0288 - X509_to_X509_REQ NULL pointer deref
CVE-2015-0289 - PKCS7 NULL pointer dereferences
For 5.5:
CVE-2015-0286 - Apply fix from OpenSSL for ASN1_TYPE_cmp.
CVE-2015-0292 - Backport existing fix for Base64 decoding.
Several other issues did not apply or were already fixed.
Refer to https://www.openssl.org/news/secadv_20150319.txt
Thanks to the OpenSSL team for providing patches.
5.5 patch:
http://ftp.openbsd.org/pub/OpenBSD/patches/5.5/common/024_openssl.patch.sig
5.6 patch:
http://ftp.openbsd.org/pub/OpenBSD/patches/5.6/common/020_openssl.patch.sig
untrusted comment: signature from openbsd 5.6 base private key
RWR0EANmo9nqhs3L3uaeagbDgYSaBJ3w1MivqvATSTrquGgKHm0sNWVTudl/oumq7hVfVD+KX0LtxlkCQpA5JaPYwTO0OYHy</pre>Ted Unangst2015-03-19T14:26:44libxfont erratahttp://permalink.gmane.org/gmane.os.openbsd.announce/222
<pre>Patches are now available to fix buffer overflows in libXfont. This issue
affects 5.5, 5.6, and the forthcoming 5.7 release.
For more details, refer to the X.org advisory:
http://www.x.org/wiki/Development/Security/Advisory-2015-03-17/
5.5 patch:
http://ftp.openbsd.org/pub/OpenBSD/patches/5.5/common/023_libxfont.patch.sig
5.6 patch:
http://ftp.openbsd.org/pub/OpenBSD/patches/5.6/common/019_libxfont.patch.sig
untrusted comment: signature from openbsd 5.6 base private key
RWR0EANmo9nqhnSKDBy7WgkNZrLujusI8Qvntb9/tVW0P3tfc0eRZ37NLCk0qcu5lurRs5aKGI6y5kGCXgAGE6tos5xwEjWbiw8=
OpenBSD 5.6 errata 19, March 18, 2015
More BDF file parsing issues in libXfont
Afer IOActive's Ilja van Sprundel who found a number of issues in
2014, additional testing by Alan Coopersmith and William Robinet with
the American Fuzzy Lop (afl) tool uncovered two more issues in the
parsing of BDF font files.
Apply patch using:
signify -Vep /etc/signify/openbsd-56-base.pub -x 019_libxfont.patch.sig \
-m - | (cd /usr/xenocar</pre>Ted Unangst2015-03-18T08:06:19LibreSSL 2.1.5 releasedhttp://permalink.gmane.org/gmane.os.openbsd.announce/221
<pre>We have released LibreSSL 2.1.5, which will be arriving in the
LibreSSL directory of your local OpenBSD mirror soon.
This release is relatively small, focused on bug fixes before 2.2.x
development begins along-side OpenBSD 5.8.
This or earlier LibreSSL releases may also address issues that are to be
revealed by The OpenSSL Project Team on the 19th of March, 2015.
The LibreSSL team is not typically apprised of OpenSSL-related security
issues in advance. We will address any previously-unknown issues that
are found to affect LibreSSL in future releases.
Issues addressed since 2.1.4:
* Fix incorrect comparison function in openssl(1) certhash command.
Thanks to Christian Neukirchen / Void Linux.
* Windows port improvements and bug fixes.
- Removed a dependency on libgcc in 32-bit dynamic libraries.
- Correct a hang in openssl(1) reading from stdin on an connection.
- Initialize winsock in openssl(1) earlier, allow 'openssl ocsp' and
any other network-related commands to function properly.
* Rej</pre>Brent Cook2015-03-17T00:54:33libssl patch availablehttp://permalink.gmane.org/gmane.os.openbsd.announce/220
<pre>When CVE-2015-0204 (RSA silently downgrades to EXPORT_RSA) was announced,
it was labeled "Severity: Low". Our assessment at the time was that export
ciphers had already been removed prior to the release of 5.6, and that the
fix was not worth backporting to 5.5.
Then CVE-2015-0204 was renamed the FREAK attack. Now it has a fancy name so
you know it's important.
Unfortunately, our original assessment was not entirely correct. Some of the
features exploited by FREAK were not deleted until after 5.6, although this
was not known until testing tools became available. We've corrected libssl
by backporting the necessary changes to 5.6.
The patch below includes the fix for CVE-2015-0204 as well as some other "low
severity" fixes for similar downgrade issues relating to ECDHE.
Statement regarding 5.5: SSL/TLS is hooped. There have been too many changes,
large and small, that make backporting and testing indvidual fixes difficult.
Additionally, many small fixes get overlooked.
Thanks to Florian Riehm for pointin</pre>Ted Unangst2015-03-11T20:43:45freetype patches availablehttp://permalink.gmane.org/gmane.os.openbsd.announce/219
<pre>FreeType 2.5.5 contained more fixes for malformed font buffer overflows.
Thanks to David Coppa for extracting the necessary patches from the Ubuntu
package.
Patches are available for OpenBSD 5.5 and 5.6. The forthcoming 5.7 release
already includes FreeType 2.5.5.
http://ftp.openbsd.org/pub/OpenBSD/patches/5.5/common/022_freetype.patch.sig
http://ftp.openbsd.org/pub/OpenBSD/patches/5.6/common/018_freetype.patch.sig
The 5.6 patch also includes some fixes for CJK hinting.
untrusted comment: signature from openbsd 5.6 base private key
RWR0EANmo9nqhswc4xbXD01rhx1+T2nG0N/NlVICVOW187z5BoZQ7PJjx6OAijnCk1AJJqUOODgov/JniEFHmQIE5tis+61NDAo=
OpenBSD 5.6 errata 18, Mar 13, 2015:
Another fix for buffer overflows in malformed fonts.
Apply patch using:
signify -Vep /etc/signify/openbsd-56-base.pub -x 018_freetype.patch.sig \
-m - | (cd /usr/xenocara &amp;&amp; patch -p0)
Then build and install a new libfreetype:
cd /usr/xenocara/lib/freetype
make obj
make build
Index: lib/freetype/include/ftimag</pre>Ted Unangst2015-03-11T20:20:07OpenBSD Foundation GSOC 2015http://permalink.gmane.org/gmane.os.openbsd.announce/218
<pre>The OpenBSD Foundation is pleased to announce that we have been
accepted as a mentoring organization for Google Summer of Code 2015.
As such if you are a student who qualifies to apply for GSOC, you will
be able to find us in Google's Summer of Code Application process.For
details on the application process and the relevant timelines please see
https://www.google-melange.com/gsoc/homepage/google/gsoc2015
We have an ideas page which is located at
http://www.openbsdfoundation.org/gsoc2015.html
I will repeat my usual disclaimer here on behalf of the foundation -
doing anything with GSOC does *not* guarantee the result will end up
in OpenBSD or any related project. That having been said
we hope to be able to put some mentors together with students to
accomplish things that may become useful to the community at large.
.... Ken Westerback, The OpenBSD Foundation ....
</pre>Kenneth Westerback2015-03-04T14:32:34Search EngineSearch the mailing list at Gmanequeryhttp://search.gmane.org/?group=$group=gmane.os.openbsd.announce